Cloudflare Fixes Cross-Tenant Data Exposure in Containers
Cloudflare's container vulnerability exposed SQLite databases across four continents—a reminder that multi-tenant infrastructure risks touch every enterprise running containerized workloads.
Why it matters
A cross-tenant data exposure in Cloudflare's Containers and Sandboxes service revealed that thin-provisioned storage without block zeroing leaked complete databases, directory structures, and sensitive data across regions. Cloudflare has patched it with no confirmed exploitation, but the incident underscores operational security gaps in serverless/container deployments that enterprises rely on.
The key facts
9 to knowVulnerability: thin-provisioned storage pools skipped zeroing of reused blocks in Cloudflare Containers and Sandboxes
Scope: researchers recovered directory structures, database pages, and complete SQLite databases across four continents
Status: Cloudflare remediated; no evidence of exploitation found
Root cause: storage reuse without secure erasure between tenants
Disclosure source: Steef-Jan Wiggers / InfoQ, October 5, 2026
Vulnerability: thin-provisioned storage pools configured to skip zeroing reused blocks in Containers and Sandboxes
Impact: researchers recovered directory structures, database pages, and complete SQLite databases across four continents
Root cause: storage-layer configuration, not cryptographic bypass
Affected service: Cloudflare Containers and Sandboxes (serverless/edge compute)
Go to the source
InfoQ AI/MLinfoq.com
Publisher excerpt: Cloudflare has disclosed a cross-tenant data exposure vulnerability in Containers and Sandboxes, caused by thin-provisioned storage pools configured to skip zeroing reused blocks. Researchers recovered directory structures, database pages and complete SQLite databases across four continents.…